What happened
Vulnerability fixed, no compensation reported
In late August 2023, BitBrowser users began reporting stolen private keys and funds from crypto wallets. The company initially pointed to a vulnerability in certain versions of WPS for Windows in its community. On August 26, as relayed by industry publications, it sent a notification saying that cached data on its servers had been compromised. Wallets belonging to users who had enabled extension-data synchronization were at risk, and they were advised to transfer their assets immediately. On August 29, the company wrote in an in-app notice that attackers had targeted its data storage server (OSS). According to one of those publications, extension caches were downloaded from the server in early August, with the last such log entry dated August 2. According to its analysis, the passwords to the cached wallets were guessed using the same users’ passwords from other websites.
Who was affected
> 3,000 wallets (media reports)
According to the company, only crypto-wallet users were affected. Those who had enabled extension-data synchronization were at risk; the attack did not affect anyone else. The company did not disclose the number of victims. According to industry publications, more than 3,000 wallets suffered losses, with the largest individual loss reaching $60,000. They do not say who made these calculations.
Losses
at least $410K (SlowMist)
At least $410,000, according to an estimate by the founder of SlowMist on August 27, 2023; the SlowMist Hacked database lists no less than $520,000, also citing the SlowMist founder. According to MistTrack (SlowMist), by September 3, 236.27 ETH (≈ $386,000, 70.6% of the stolen funds) had been sent through the eXch mixer; by September 4, the figure had reached 307.48 ETH (≈ $502,000, 87% of the stolen funds). The company itself did not disclose the amount.
What the company did
The company advised users to transfer their assets and contacted the police. On August 31, it posted a receipt showing that the Changping District police station in Beijing had accepted its report on August 27. On September 14, it said that the Changping cyber police had opened a case. It did not report the results of the investigation. According to industry publications, the company also contacted MetaMask to freeze the attacker’s wallets. On August 29, SlowMist chief information security officer 23pds wrote that, together with partners, he had intercepted some of the funds. In version 5.0.9, released on August 29, the company strengthened cache-synchronization security, disabled the feature in older versions, introduced a mandatory password for synchronizing extension data, and temporarily disabled extension synchronization between profiles. In its in-app notice, the company itself linked these measures to the attack. On September 8, the company apologized to affected users and attached an announcement about a September discount of up to 50% on plans. According to the promotion’s terms, it was available to all users. It did not announce any reimbursement of the stolen funds.
Our editors collected and checked the sources; the text says who gives each figure.